CVE-2026-91130: Home Assistant XSS Vulnerability in Statistics Graph Card
Summary
CVE-2026-91130: Home Assistant: XSS in Statistics Graph Card. Affects homeassistant versions < 2026.7.0. Fixed in 2026.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Home Assistant is an open-source home automation platform that focuses on privacy and local control. It allows users to manage and automate their smart home devices. The Statistics Graph card is a feature that visualizes data from various entities, providing insights into usage patterns. However, a vulnerability exists in this component that can lead to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the Statistics Graph card rendering entity names as raw HTML without proper sanitization. This allows an authenticated user to inject malicious scripts into the entity names, which can be executed when other users hover over data points in the graph. The issue is exacerbated by the potential for malicious names to be set by integration providers, enabling remote exploitation without direct access to the Home Assistant instance. The root cause is the absence of a filterXSS() function call on the entity name, similar to a previously fixed vulnerability in the Energy dashboard.
How To Fix
Latest published version: 2026.10.2 as of 22 Oct 2026
pip install --upgrade "homeassistant==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.7.0
This is the first release that contains the fix.
pip install --upgrade "homeassistant==2026.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Statistics Graph card for any entities that may have untrusted names. Additionally, ensure that only trusted users have access to create or modify entity names within the Home Assistant instance.
Conclusion
CVE-2026-91130 presents a significant security risk for Home Assistant users, particularly those utilizing the Statistics Graph card. It is crucial to update to the patched version to mitigate the risk of XSS attacks. Users should also be cautious about entity names and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for homeassistant →
FAQ
CVE-2026-91130 is a vulnerability in the Home Assistant Statistics Graph card that allows for Cross-Site Scripting (XSS) attacks due to unsanitized entity names.
If you are using a version of Home Assistant prior to 2026.7.0, your instance may be vulnerable. You can check your version in the Home Assistant settings.
An attacker could exploit this vulnerability to execute malicious scripts in the browsers of users viewing the Statistics Graph card, potentially leading to data theft or other malicious actions.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires no installation and can check your application against known vulnerabilities.
The CVSS score for CVE-2026-91130 is 9.3, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for homeassistant.
